201212040726 149c53

explained decrypted filler

seed 329

Metadata

Post ID: 149c53
Title: 201212040726 → 2012-12-04 07:26 on A858's clock
Posted (UTC): 2012-12-04 12:26:21
Timezone: UTC−5 · title 07:26 against posted 12:26 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201212040726) = a83cb223cd81e826b3c34770a4a33dc5 (name+title)
GUIDs: 15
Filler GUID seed: new Random(329).Next(9) ✓ verified
Run: Run 39 (seed 1,106,402,812) (seed)
Draw: 31 · predicted N = 15 ✓
Machine boot: 2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DFF998C480D2B159 5D363440B0664F86 493F2577B37DF7BF 7BF7CC2E2180DE51 70B9C9D957B96D32 36D339BA9CF263AD EA311DCFB4383282 3794EA2D155F17F9 69036AD8B694FEE6 74023B73478E7A81 19E24DED0BBD8F23 D21D7A3D2442194F 1F8011B5954E7530 ED262BA3DA024656 EF62ECF055025C20 0E9C68E03E8B9524 7CD2BD7191086A27 3208E4914EAF2E28 092129BCDCD42472 E650164CE5ECEB80 170DDCD50BE7CB3E 8EBF8C3A0AAF60A6 89A03235C8BE8069 7F8109AE4B1C32B0 8F1AA06EC79BA27A 5E938FE8BDF71EEC B802E035DFA20D3A 567890DEF84AF2FF AE4AF97C9FF97718 0BAAA96AD0400A78 1989CB7CE05F6E2E F0877603FEA619E8 7F4037B9C8D2C484 DB91BB77ABB998F2 76E2C501175AE47A AAA07F860FDE3F3C 1A5A971EB9E6F770 C0348C252D9664B3 6A1BC3DBCDC857EC 9B21056551374692 546FEDE69B8522E0 65D8D1FB1AC0F2C3 8BC19353EC53A3B7 7E280D31F182517D 876ADE69170DDD40 02D2C4F27E3D16D5 AA3AE9D78D21A732 6745F3EC3BF96A17 C63ADE1E89191FFA 3837BB19E0872AFE 3AF1F9834E8A1FFD A7483ED5399952E0 29DEDBE5A6B8ED7A 74835451D76C0CB6 045971113B71D4CD 875EB5D32428A527 2A3C293FB498C3B1 C79CC8470BC109F1 66D0709E38058404 1E7E07965B24BBFC 9A1155B948907A0E

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201212040726 (name+title). Key = MD5(password) = a83cb223cd81e826b3c34770a4a33dc5, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a79e6805-e4c1-5324-a45b-ffb349db02f0
  2 24aacfe8-718b-3e9f-9923-16525d7927cb
  3 4c3a70aa-6b0b-6eb1-a96d-b48b643de1f2
  4 85aee808-6465-78be-a649-b795a607a2aa
  5 6b2a880b-f287-6195-a8d5-efcb9011044e
  6 22214c6d-741b-0db3-8c38-6da892e0924e
  7 10d069db-425c-2265-ad8a-c43ee6469810
  8 ef15a049-c0d9-4fb2-80c6-863f4b6bf753
  9 1f86c37f-e216-6253-a349-61ba4afd26a9
 10 6a9700e9-5a7c-52ff-bf69-f4903b30e316
 11 de9ccde4-2320-6d28-87e2-b8a42572b12f
 12 819f31b3-5586-2cf0-9b3c-ba6ac9deed24
 13 062616bb-21aa-7fe7-8109-9de9a15dd94e
 14 3e7365c4-b2d0-5531-af6a-31f056c10226
 15 9101ed10-88e2-2ab8-b62b-52740c24ce72

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 536760246562752. Exactly this sequence comes out of new Random(329).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 31 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related